configure system ndr settings

Use this command to configure NDR- related features, such as enabling or disabling the databases for the IPS engine and managing pcap capturing.

Syntax

config system ndr setting
set ips-dbs { nids | apdb | isdb| otapp | none}
	set dump-pcap {enable | disable}
	set type {IOC | botnet | encrypted-attack  | network-attack  | weak-cipher}
	set external-path <external_path_str>
end

Multiple Options	Description	Default
Ips-dbs { nids apdb isdb otapp | none}	Turn off or on nids, apdb, isdb or otapp database for IPS Engine. Use none to deselect all dbs for IPS Engine.	nids apdb
dump-pcap {enable | disable}	Select to enable conditional pcap capturing feature. The number of anomaly session captures and packets that can be collected will depend on the device model. This feature is not supported on VM models. The maximum size of each capture file is 1 MB. PCAP availability is commonly subject to latency. The tested FortiNDR-1000F max throughput when pcap-dump is enabled is 2Gbps for 1 hour.	disable
type {IOC | botnet | encrypted-attack | network-attack | weak-cipher}	Select anomaly types events that will trigger pcap capturing. Multiple choices are supported.	botnet encrypted-attack network-attack IOC
External-path <external_path_str>	Enter the artifact storage profile name to enable pcap external storage. If there is no artifact storage profile specified, local disk storage will be enabled. For more information, see Artifact Storage.